Directus' TUS resumable upload endpoint (/files/tus) allowed any authenticated user with basic file upload permissions to overwrite arbitrary existing files by specifying their UUIDs. The controller performed only collection-level authorization and never validated item-level access to the specific file being replaced. As a result, row-level permission rules that normally prevent users from modifying files they do not own were bypassed. An attacker could replace any stored file with malicious content, compromising data integrity and potentially enabling further attacks.

This vulnerability affects Directus versions earlier than 11.16.1. All installations of Directus prior to 11.16.1 are vulnerable; installations of 11.16.1 and later are not impacted.

The flaw scores 7.1 on the CVSS scale, indicating high severity. Exploitation requires only authentication and standard upload rights, making it relatively easy for legitimate users. No public exploits or KEV listings are currently available. The attack vector is authenticated.